MikroTik Security Advisories & CVEs
3 advisories tracked · MikroTik Security Announcements + NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your MikroTik device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in MikroTik's recent advisories.
Official source
MikroTik Security Announcements + NVD
MikroTik publishes official security announcements at mikrotik.com/supportsec, but has no machine-readable feed and its CVEs are assigned by several CNAs. VulniPulse joins NVD candidate metadata to the server-rendered official announcement index, then releases an alert only after fetching the linked article and verifying its CVE identity in the article heading or body. Covers RouterOS (v6/v7), SwOS, Winbox, The Dude and MikroTik router/switch hardware (hEX, CCR, CRS, cAP, wAP).
Latest MikroTik advisories
Critical [CVE-2026-86060] SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all. RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. Affected product named by the advisory: MikroTik RouterOS.
Critical [CVE-2026-67276] SSH user impersonation possible in Mikrotik RouterOS
MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels. This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. Your device should already give you the option to upgrade software in the “Check for updates” menu. Fix is included in: 7.25 beta 3. 7.24.2. 7.23.4. 6.49.21. For regular home device users the issue does not pose an immediate risk, but we still suggest all users to upgrade. Steps to be taken Make sure SSH is not open to any untrusted networks. MikroTik default configuration blocks this port from the internet by default, but if you have manually opened this port, make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all. RouterOS will check if your device has been compromised, and set it to “Flagged” status if it is. This will be written in the “Log” section. Affected product named by the advisory: MikroTik RouterOS.
Critical [CVE-2023-30799] RouterOS: MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue.
A new CVE has been published, which describes a policy elevation issue, where a logged in administrator with “policy” permissions (able to grant additional permissions to any user on the router), is also able to send crafted configuration commands, that are exchanged internally by the router software components and normally are rejected when sent by a user. This can be used as a stepping stone to execute arbitrary code on the router, allowing the connected user to gain control of the underlying operating system upon which RouterOS runs. To be able to use this discovered exploit, one would need administrative access to RouterOS, i.e. a known username and password, as well as a ways to connect (no firewall). This is not the only way how a logged in administrator user with such a high access level (as required for this exploit) can compromise the router. Other possibilities include: saving, modifying and restoring configuration backup; installing additional software packages; using another device on the local network to perform network reinstall of the router to a known vulnerable version. Affected product named by the advisory: MikroTik RouterOS.